{
  "Event": {
    "analysis": "1",
    "date": "2026-06-08",
    "extends_uuid": "",
    "info": "[Threat Intel] Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)",
    "protected": false,
    "publish_timestamp": "1781559732",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1781559732",
    "uuid": "a362920c-5c4c-41c8-a8ee-358d61175368",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#5dfed4",
        "local": false,
        "name": "misp-galaxy:producer=\"Check Point\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#682cad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"",
        "relationship_type": ""
      },
      {
        "colour": "#06e9fb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Addresses - T1589.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#91649a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Virtual Private Server - T1583.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#36d931",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ad3992",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Server - T1584.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#2613b0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Taiwan\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Qilin\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "link",
        "uuid": "f2e4f38a-fdf9-4557-ac54-4c095e532bbb",
        "value": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "text",
        "uuid": "e904fbb9-4b5b-4505-b053-22f06c6e2cb3",
        "value": "A critical authentication bypass vulnerability affecting Remote Access VPN and Mobile Access deployments has been actively exploited in the wild. The vulnerability exploits a logic flaw in certificate validation within the deprecated IKEv1 key exchange protocol, allowing attackers to establish VPN sessions without valid passwords. Exploitation has been observed since May 7, 2026, targeting several dozen organizations globally. One confirmed incident involved post-compromise activity linked to Qilin ransomware operations. The threat actor appears financially motivated and operates dedicated VPS infrastructure across multiple hosting providers. An additional related vulnerability affecting site-to-site VPN communications was discovered through AI-assisted code analysis, though no active exploitation has been observed. Immediate patching is strongly recommended for affected systems using IKEv1 protocol."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "text",
        "uuid": "9c4f8032-a106-4d98-9293-3ff47fb8c31d",
        "value": "Name: Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)\nAuthor: AlienVault\nAdversary: Qilin\nTags: [\"ransomware\", \"cve-2026-50751\", \"cve-2026-50752\", \"qilin\", \"remote access vpn\", \"active exploitation\", \"vpn authentication bypass\"]\nTgtd countries: [\"Taiwan\"]\nMlwr families: [\"Qilin\"]\nAttack_ids: [\"T1133\", \"T1190\", \"T1021\", \"T1589.002\", \"T1583.003\", \"T1090.003\", \"T1078\", \"T1486\", \"T1573\", \"T1071.001\", \"T1584.004\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "90634696-c6c5-4640-81e7-9f790e699e6f",
        "value": "Qilin"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435190",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "8ba6eba9-597e-4bb3-8e24-1d8778fbc367",
        "value": "45.61.136.173",
        "Tag": [
          {
            "colour": "#5beb6d",
            "local": false,
            "name": "asn:asn=\"399629\"",
            "relationship_type": ""
          },
          {
            "colour": "#6967e5",
            "local": false,
            "name": "asn:as-owner=\"BLNWX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435211",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6f3526a3-d28b-4121-9364-beec2e832f36",
        "value": "209.182.225.136",
        "Tag": [
          {
            "colour": "#c107c8",
            "local": false,
            "name": "asn:asn=\"395092\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f4306",
            "local": false,
            "name": "asn:as-owner=\"SHOCK-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435232",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "c7198407-af8e-48d2-a8eb-e539b228459f",
        "value": "144.208.127.155",
        "Tag": [
          {
            "colour": "#c107c8",
            "local": false,
            "name": "asn:asn=\"395092\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f4306",
            "local": false,
            "name": "asn:as-owner=\"SHOCK-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "bb3a3280-415d-4563-a61a-1b88486eb81e",
        "value": "CVE-2026-50751"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781089216",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "bf290dff-8b9f-4255-9f21-701d5b82c6ba",
        "value": "CVE-2026-50752"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435253",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "676b8c4f-f691-46db-ae45-042d7d0c4816",
        "value": "162.33.177.101",
        "Tag": [
          {
            "colour": "#5beb6d",
            "local": false,
            "name": "asn:asn=\"399629\"",
            "relationship_type": ""
          },
          {
            "colour": "#6967e5",
            "local": false,
            "name": "asn:as-owner=\"BLNWX\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435274",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "433c1e5e-d7e7-4d95-b523-b35ad30a2297",
        "value": "38.54.107.167",
        "Tag": [
          {
            "colour": "#e7643a",
            "local": false,
            "name": "asn:asn=\"138915\"",
            "relationship_type": ""
          },
          {
            "colour": "#1ec497",
            "local": false,
            "name": "asn:as-owner=\"KAOPU-HK Kaopu Cloud HK Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435295",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "150e1b02-3b2c-4404-8063-639ab0f5d009",
        "value": "38.54.88.201",
        "Tag": [
          {
            "colour": "#e7643a",
            "local": false,
            "name": "asn:asn=\"138915\"",
            "relationship_type": ""
          },
          {
            "colour": "#1ec497",
            "local": false,
            "name": "asn:as-owner=\"KAOPU-HK Kaopu Cloud HK Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435316",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "664a6c45-5ac8-4da0-b017-8954557a7ee2",
        "value": "38.60.157.139",
        "Tag": [
          {
            "colour": "#e7643a",
            "local": false,
            "name": "asn:asn=\"138915\"",
            "relationship_type": ""
          },
          {
            "colour": "#1ec497",
            "local": false,
            "name": "asn:as-owner=\"KAOPU-HK Kaopu Cloud HK Limited\"",
            "relationship_type": ""
          },
          {
            "colour": "#fbf8fb",
            "local": false,
            "name": "asn:as-country=\"HK\"",
            "relationship_type": ""
          },
          {
            "colour": "#daa28c",
            "local": false,
            "name": "misp-galaxy:country=\"hong kong\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check:14/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781434304",
        "to_ids": true,
        "type": "md5",
        "uuid": "b6422b05-842d-4d44-9acf-6f92ec53de0c",
        "value": "51d39aa39478beeac94f2d12f682ecce",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435337",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "b8bc869a-c0bf-4317-bea6-6d863c7850cc",
        "value": "45.77.149.152",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435358",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f71bd056-3adf-4d32-aa16-d42c19e42b8f",
        "value": "45.76.26.42",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435380",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "95637ba3-4312-4dc9-a68c-dfe4b1b290d0",
        "value": "66.42.99.200",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435401",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "67643437-1b6c-485f-8dc1-362acf6cde54",
        "value": "45.63.104.106",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435422",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "bd13c018-fa73-482a-9b5c-3d706e3e3ef4",
        "value": "146.71.81.184",
        "Tag": [
          {
            "colour": "#c107c8",
            "local": false,
            "name": "asn:asn=\"395092\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f4306",
            "local": false,
            "name": "asn:as-owner=\"SHOCK-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435443",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "16f07418-0929-49e7-9d10-5e9c52fbb8df",
        "value": "208.123.119.167",
        "Tag": [
          {
            "colour": "#c107c8",
            "local": false,
            "name": "asn:asn=\"395092\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f4306",
            "local": false,
            "name": "asn:as-owner=\"SHOCK-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435464",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "42178566-c75e-4936-aca9-c007519a6c3c",
        "value": "64.176.228.109",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435486",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "29b65a48-e833-46bb-9096-2239a4d33c7e",
        "value": "158.247.195.147",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781435507",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a8f1b69b-410c-409b-a7f5-ddf34d01aebd",
        "value": "144.208.127.134",
        "Tag": [
          {
            "colour": "#c107c8",
            "local": false,
            "name": "asn:asn=\"395092\"",
            "relationship_type": ""
          },
          {
            "colour": "#7f4306",
            "local": false,
            "name": "asn:as-owner=\"SHOCK-1\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1781435528",
        "uuid": "a4c72e9f-f46d-4f51-aec5-0a66be6123da",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1781435528",
            "to_ids": true,
            "type": "md5",
            "uuid": "e8de1ef3-2ca4-46de-92e9-29c78c8814d2",
            "value": "52fda5c1b9704544f32ee98d9060e689",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1781434303",
            "to_ids": true,
            "type": "sha1",
            "uuid": "ee196182-cf0c-4704-9c59-e78b2838f176",
            "value": "9d48d741d0a149aeadd6aef4b2c95c57833b1fef",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1781434303",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e3eaacea-b912-4a37-9e6a-43360e77089a",
            "value": "76842bcd75b4429e2c92636274ab0395d91c441c6aea9b76fe8a051659b0c1fc",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#260093",
                "local": false,
                "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1781433849",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0a2a57b2-d27a-4d93-a8a7-0bc810d1ef28",
            "value": "393216:/lfwSLIJ1MVKZXW5yE/LKEMmBpsgJXheWsJyhYiFXL:/lfwSLIJ1AI8/BCAhjXL"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1781433849",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "4283d59e-2471-473f-8286-678139fb1631",
            "value": "76251320"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1781433849",
            "to_ids": true,
            "type": "vhash",
            "uuid": "282df236-5c15-47a3-a504-ea49c8f89a87",
            "value": "e840a106aec60742c59f25fa4dd95c2b"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1781433849",
            "to_ids": true,
            "type": "filename",
            "uuid": "e55bba29-fa93-47d0-a567-3c3060161f85",
            "value": "76842bcd75b4429e2c92636274ab0395d91c441c6aea9b76fe8a051659b0c1fc.elf"
          },
          {
            "category": "Other",
            "comment": "Checked: 14/06/2026\nLast-scan\t:  14/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1781433849",
            "to_ids": false,
            "type": "text",
            "uuid": "164c5856-4a4b-46d8-b775-7fec76fbf23c",
            "value": "Type Description: ELF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-04-08T13:55:07.000000+00:00\nLast Submission:2026-06-10T10:02:44.000000+00:00"
          }
        ]
      }
    ]
  }
}